VoidExternalPATCHED[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
VoidExternalPATCHED.exe
Size 3.0MB
Sample260707-bpswlscs3m
SHA256 eb8511d7b0f6d89206dfc54db77d50a805f92cc229fb10c7d79b2e02c9f8b60a
MD5 35361643bab1e9c34f97eb12fddf4d9d
SHA1 a995488ee8072c8b6c14583776934ee0566f6630
SHA512 f4d13b54ada568b1d9a78093d7035c20cb66810c39c7f86d30fa2dad54cefbe53f71a6253a1e2bacc50b5e958f53655a41046df6049b53693db4ba1a9eea8164
SSDEEP 24576:yh0PPgi1FGvCqQZ1xNZICU0G2nmhbma4uzrvghGcrQg6I1lzMg/zyfu3fncf8t34:54gjYEzThD0XFAyLqXQJPpe8Drn
TLSH
T15CE58C31A18C9B6DF062B174DC87962393F17C4CA360CF9766E04DF31A5F998BB69209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VoidExternalPATCHED.exe

File Explorer

VoidExternalPATCHED.exe

.exe 3.0MB

VoidExternalPATCHED.exe

IMPHASH 80fba8489c96127ed0237e009e94017b
SHA256 eb8511d7b0f6d89206dfc54db77d50a805f92cc229fb10c7d79b2e02c9f8b60a
MD5 35361643bab1e9c34f97eb12fddf4d9d
SHA1 a995488ee8072c8b6c14583776934ee0566f6630
SHA512 f4d13b54ada568b1d9a78093d7035c20cb66810c39c7f86d30fa2dad54cefbe53f71a6253a1e2bacc50b5e958f53655a41046df6049b53693db4ba1a9eea8164
SSDEEP 24576:yh0PPgi1FGvCqQZ1xNZICU0G2nmhbma4uzrvghGcrQg6I1lzMg/zyfu3fncf8t34:54gjYEzThD0XFAyLqXQJPpe8Drn
TLSH
T15CE58C31A18C9B6DF062B174DC87962393F17C4CA360CF9766E04DF31A5F998BB69209
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2667892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle GetConsoleCursorInfo CreatePipe WaitForSingleObject OpenProcess Sleep SetConsoleCursorInfo QueryFullProcessImageNameA GetCurrentThread CloseHandle K32EnumProcesses GetThreadContext GetModuleHandleW CreateProcessA SetConsoleCursorPosition IsDebuggerPresent GetComputerNameA VirtualAllocEx GetProcessId CompareStringOrdinal CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW Module32NextW SetEndOfFile WriteConsoleW HeapSize CreateFileW HeapReAlloc SetStdHandle GetProcessHeap SetEnvironmentVariableW ReadFile GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileAttributesExW CreateProcessW GetExitCodeProcess GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx QueryPerformanceCounter FreeLibrary GetProcAddress GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetCommandLineW GetCommandLineA IsDBCSLeadByte QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GetLocaleInfoA FreeEnvironmentStringsW GlobalUnlock WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection RtlUnwind EnterCriticalSection CompareStringW OutputDebugStringA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx

user32

GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetKeyboardLayout SetClipboardData ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo GetKeyState DefWindowProcW SendInput UpdateWindow PostQuitMessage SetWindowLongW FindWindowW TranslateMessage SetLayeredWindowAttributes GetClipboardData EmptyClipboard CloseClipboard GetCursorPos TrackMouseEvent OpenClipboard MessageBoxA DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

ShellExecuteW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

WSAStartup getaddrinfo closesocket WSACleanup send socket connect recv freeaddrinfo setsockopt

winhttp

WinHttpOpen WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect

secur32

EncryptMessage AcquireCredentialsHandleA DeleteSecurityContext QueryContextAttributesW InitializeSecurityContextA FreeCredentialsHandle DecryptMessage FreeContextBuffer

bcrypt

BCryptDestroyKey BCryptVerifySignature BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptCreateHash BCryptGetProperty

crypt32

CertFreeCertificateContext

d3d11

D3D11CreateDeviceAndSwapChain

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

179KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VoidExternalPATCHED.exe

kernel32

user32

advapi32

shell32

imm32

d3dcompiler_47

dwmapi

ws2_32

winhttp

secur32

bcrypt

crypt32

d3d11

generic